Hickory DNS CVE-2026-123570

No special configuration required - remote unauthenticated triggering against default deployments of hickory-dns/hickory-proto 0.18 through 0.26.1. Two reachable paths per the advisory: (1) server mode, where any attacker can send a UDP datagram, and (2) client/resolver mode, where a spoofed DNS response reaches the same parser. The limiting factor is amplification scale: each crafted message reserves only ~18MB and parsing then fails, so a sustained outage requires a stream of messages rather than one packet; there is no authentication, user interaction, or non-default setting needed to reach the vulnerable code path.

All signals point to an availability-only denial-of-service with no confidentiality or integrity impact: the input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) describes remote, unauthenticated, low-complexity triggering with HIGH availability impact and no scope change, consistent with the CWE-400/CWE-770 uncontrolled-resource-allocation mechanism. The vuln.today decision label is 'this_week' (not act_now/emergency), and there is no CISA KEV listing and no EPSS score supplied, so there is no confirmation of active or probable near-term exploitation - this reads as a credible but not fire-drill priority. No EPSS value and no KEV means widespread-exploitation probability cannot be quantified from the data; absence of those signals is not evidence of safety but also does not elevate this to emergency status. The practical ceiling on severity is that each malicious message forces only ~18MB and then parsing fails, so a sustained outage requires a stream of messages rather than a single packet - the HIGH availability rating reflects that repeated sending can exhaust memory, not a one-shot crash. Net: a real, worth-patching remote DoS in a DNS library, but not a high-CVSS-masking-low-risk case nor an in-the-wild emergency on current evidence.

A remote attacker sends a single UDP DNS datagram (to a hickory-dns server) or a spoofed DNS response (to a client/resolver using hickory-proto) with the ANCOUNT, NSCOUNT, and ARCOUNT header fields all set to 65535. The parser preallocates record vectors sized by those untrusted counts before reading any record data, reserving about 18MB per message; repeating this rapidly drives memory exhaustion and denial of service. No public exploit identified at time of analysis, though the mechanism is fully described in the GHSA advisory.